The GDPR API and Adobe I/O Events: Using Push Notifications to Make GDPR Compliance Easier

Duane Richards
May 30 · 3 min read

If you do business in Europe, then you know the importance of GDPR. The General Data Protection Regulation came into effect last year, bringing a harmonized and modernized set of data protection requirements. The core principle is to better protect the data of EU citizens, and that brought a whole host of technical challenges for anyone who collects personal data.

At the same time, we at Adobe rolled out the GDPR API to provide everything Adobe Experience Cloud customers need to meet the new requirements. The API allows anyone who controls data to send Data Subject Access and Delete requests to Experience Cloud, effectively meeting EU regulations.

But handling all those requests via API calls has posed a big hurdle for data controllers, especially those dealing with massive user bases. That’s why we’ve developed a new solution that should get the job done in a better way.

Dealing with thousands of email notifications per day

For some of our larger Experience Cloud customers, complying with GDPR access and delete requests means dealing with thousands of submissions every day. While they use Job GET Status API to check on the results of these API calls, thousands of requests also meant thousands of emails being delivered. Email notifications were removed as a result of the overwhelming traffic and inbox churn our customers experienced. Thus we needed another way to let customers know their jobs were complete.

The current GET API does return the archive file URL if the job is complete, so customers can see, through their polling, that they have content to be delivered. We discovered this constant polling of the API could be reduced significantly if customers could create a callback/webhook that listens for notifications from the service. That’s why we’ve now implemented a special Adobe I/O Events workflow for the GDPR API: a way to leverage our pipeline and the Adobe I/O Console to deliver push notifications based on customer subscriptions and configurations.

I/O Events: Push notifications help better manage GDPR requests

I/O Events sends out well-defined messages for key milestones of a GDPR job, via the I/O Console. These messages can be listened to by a customer and acted on through automation, based on real-time event subscriptions in the I/O Console (console.adobe.io).

Message types supported

All messages will be prefixed with the domain com.adobe.platform.gdpr.{type}, and will encompass the message types below:

  • jobcomplete: All solutions have completed their work (if required), and the overall job status is set to COMPLETE.
  • joberror: At least one solution has reported an error and the overall job status is set to ERROR.
  • productcomplete: One of the solutions has completed its work and reported back to the central service.
  • producterror: One of the solutions has reported back with an error of some kind.

As each job reaches the milestone (called out by the event type), I/O Events will push a notification to the registered webhook along with information containing the individual job ID and any other pertinent information for the customers to act upon. The event JSON data will follow the CloudEvents standard format and look similar to this:

CloudEvents is a specification for describing event data in common formats to provide interoperability across services, platforms, and systems. Adobe is participating in the CloudEvents working group and GDPR events is the first event provider published using this standard.

A better way to manage GDPR compliance

When you integrate with I/O Events for GDPR, you facilitate more seamless automation, quicker troubleshooting, and real-time notification for all your GDPR traffic. Our hope is that you will find this new feature compelling and intuitive, and that it will make compliance for your organization that much simpler.

Follow the Adobe Tech Blog for more developer stories and resources, and check out Adobe Developers on Twitter for the latest news and developer products.

Adobe Tech Blog

News, updates, and thoughts related to Adobe, developers, and technology.

Duane Richards

Written by

Adobe Tech Blog

News, updates, and thoughts related to Adobe, developers, and technology.